Password is stored in Users & Groups Data File in Preferences folder. Offset is different on each system and depends on Users & Groups configuration, but it always lie after owner's username. It's not so difficult to find it using
hex editor, even if we don't know owner's username.

OS X does maintain an /etc/passwd file (naughty, naughty), but it only references this when in single user mode. The NetInfo database, which is normally referenced by the system for day to day password usage can be found:

/var/db/netinfo/local.nidb

There are some other interesting files hiding out in /var/db, so you might want to look around in there for a bit.